JWT Processing and the 'jwt' Library

Example Code

import jwt
import datetime
import time

 --- Configuration ---
 IMPORTANT: In a real application, this key should be strong (long, random string)
 and stored securely (e.g., environment variable, KMS). Never hardcode in production.
SECRET_KEY = "a-very-secure-and-long-secret-key-for-jwt-signing-1234567890"
ALGORITHM = "HS256"  HMAC-SHA256 is a symmetric algorithm; same key for signing and verifying.

print("--- JWT Creation (Encoding) ---")
 1. Define the payload (claims) for the JWT
 'exp' (expiration time) is a registered claim, highly recommended for security.
 It's a Unix timestamp. datetime.datetime.utcnow() provides UTC time, essential for 'exp'.
payload = {
    "user_id": "auth_user_123",
    "username": "Alice",
    "roles": ["user", "editor"],
    "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=30),  Token expires in 30 minutes
    "iat": datetime.datetime.utcnow(),  Issued At time
    "iss": "your_auth_server"  Issuer
}

 2. Encode the payload into a JWT using the secret key and algorithm
try:
     jwt.encode returns a byte string; we decode it to a UTF-8 string for easy printing/storage.
    token = jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
    print(f"Generated JWT: {token}")
except Exception as e:
    print(f"Error generating JWT: {e}")
    token = None  Ensure token is None if creation fails

print("\n--- JWT Verification (Decoding) ---")
 3. Simulate receiving the token (e.g., from an Authorization header) and then decoding/verifying it
if token:
    try:
         jwt.decode verifies the signature, checks 'exp' and 'nbf' claims by default.
         The 'algorithms' parameter is crucial for security to specify allowed algorithms.
        decoded_payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        print(f"Decoded Payload: {decoded_payload}")
        print(f"User ID from token: {decoded_payload.get('user_id')}")
        print(f"Username from token: {decoded_payload.get('username')}")
        print(f"Roles from token: {decoded_payload.get('roles')}")

         --- Demonstration of an intentionally expired token (uncomment to test) ---
         print("\n--- Testing Expired Token ---")
         expired_payload = {
             "user_id": "expired_user",
             "exp": datetime.datetime.utcnow() - datetime.timedelta(minutes=5)  5 minutes in the past
         }
         expired_token = jwt.encode(expired_payload, SECRET_KEY, algorithm=ALGORITHM)
         print(f"Attempting to decode an intentionally expired token: {expired_token}")
         try:
              The decode function will raise ExpiredSignatureError for expired tokens.
             jwt.decode(expired_token, SECRET_KEY, algorithms=[ALGORITHM])
         except jwt.ExpiredSignatureError:
             print("Successfully caught ExpiredSignatureError: Token has expired as expected!")
         except Exception as e:
             print(f"Caught an unexpected error for expired token: {e}")

    except jwt.ExpiredSignatureError:
        print("Error: Token has expired!")
    except jwt.InvalidSignatureError:
        print("Error: Invalid signature! Token might be tampered with or signed with a wrong key.")
    except jwt.DecodeError as e:
        print(f"Error decoding token: {e}. This could mean a malformed token or an unsupported algorithm.")
    except Exception as e:
        print(f"An unexpected error occurred during decoding: {e}")
else:
    print("No token was successfully generated, so decoding cannot be performed.")